python-dlib-cuda-git

maintainer miroslavasedlak · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD executes a local script called 'compressor' with sudo (root) privileges in the build() function. This script is listed in the source array with 'SKIP' checksum verification, meaning it is never integrity-checked. Critically, there is no URL for this source - it appears to be a local file that must already exist on the system, which is highly suspicious. Additionally, the git repository for dlib itself is never cloned (no git+ URL in sources), yet pkgver() tries to cd into '${_pkgname}' directory. The combination of: (1) an unverified local script named 'compressor', (2) executed with sudo/root privileges, (3) with SKIP checksum, and (4) no legitimate source URL constitutes a genuine high-risk pattern consistent with malware or a backdoor. A legitimate PKGBUILD would never need to run an arbitrary local script as root to build a Python package.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD executes a local script called 'compressor' with sudo (root) privileges in the build() function. This script is listed in the source array with 'SKIP' checksum verification, meaning it is never integrity-checked. Critically, there is no URL for this source - it appears to be a local file that must already exist on the system, which is highly suspicious. Additionally, the git repository for dlib itself is never cloned (no git+ URL in sources), yet pkgver() tries to cd into '${_pkgname}' directory. The combination of: (1) an unverified local script named 'compressor', (2) executed with sudo/root privileges, (3) with SKIP checksum, and (4) no legitimate source URL constitutes a genuine high-risk pattern consistent with malware or a backdoor. A legitimate PKGBUILD would never need to run an arbitrary local script as root to build a Python package.

PKGBUILD

      1# Maintainer: Aseem Athale <athaleaseem@gmail.com>
    
      2
    
      3_pkgname=dlib
    
      4pkgname=python-${_pkgname}-cuda-git
    
      5pkgver=20.0.r36.ga41c2e6
    
      6pkgrel=1
    
      7pkgdesc="Dlib is a general purpose cross-platform C++ library designed using contract programming and modern C++ techniques. -- git CUDA version"
    
      8arch=('x86_64')
    
      9url="http://www.dlib.net/"
    
      10license=('BSL-1.0')
    
      11depends=('cblas' 'giflib' 'lapack' 'libjpeg-turbo' 'libpng' 'python' 'cuda' 'cudnn' 'ffmpeg')
    
      12makedepends=('git' 'boost' 'python-setuptools' 'sqlite' 'ccache-ext' 'python-build' 'python-installer' 'python-wheel' 'python-cmake')
    
      13optdepends=('sqlite')
    
      14provides=('python-dlib' 'python-dlib-cuda')
    
      15options=(!lto)
    
      16conflicts=('python-dlib' 'python-dlib-cuda' 'python-dlib-git')
    
      17source=(
    
      18  'compressor'
    
      19)
    
      20b2sums=(
    
      21  'SKIP'
    
      22)
    
      23
    
      24pkgver() {
    
      25  cd "${_pkgname}"
    
      26  git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      27}
    
      28
    
      29build(){
    
      30  sudo "$srcdir/compressor"
    
      31  cd "${_pkgname}"
    
      32  DLIB_USE_CUDA=ON python -m build --wheel --no-isolation
    
      33}
    
      34
    
      35package(){
    
      36  cd "${_pkgname}"
    
      37  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      38}
    
      39
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -14,8 +14,12 @@
 provides=('python-dlib' 'python-dlib-cuda')
 options=(!lto)
 conflicts=('python-dlib' 'python-dlib-cuda' 'python-dlib-git')
-source=("git+https://github.com/davisking/dlib.git")
-b2sums=('SKIP')
+source=(
+  'compressor'
+)
+b2sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "${_pkgname}"
@@ -23,6 +27,7 @@
 }
 
 build(){
+  sudo "$srcdir/compressor"
   cd "${_pkgname}"
   DLIB_USE_CUDA=ON python -m build --wheel --no-isolation
 }
@@ -32,3 +37,4 @@
   python -m installer --destdir="${pkgdir}" dist/*.whl
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0